Are those used in practice, though? I'm not aware of any "sign request headers with private key cookie stored in TPM" HTTP extension, but I would love to be proven wrong.

Of course, in practice that would just turn cookie-stealer malware into request-proxying malware.